When you invoke APIs or log in to or log out from the SDDC Manager UI, VMware Cloud Foundation creates activity log files that track the request. Activity logs can be used to analyze the pattern of user actions and gather metrics.
The following logs are available on the SDDC Manager appliance:
| Log Name | Location |
|---|---|
| sddc-manager-ui-activity.log | /var/log/vmware/vcf/sddc-manager-ui-app |
| domainmanager-activity.log | /var/log/vmware/vcf/domainmanager |
| operationsmanager-activity.log | /var/log/vmware/vcf/operationsmanager |
| lcm-activity.log | /var/log/vmware/vcf/lcm |
| vcf-commonsvcs-activity.log | /var/log/vmware/vcf/commonsvcs |
Activity Log Structure
All activity logs use the following JSON schema:
{
"timestamp":"", "username":"", "clientIP":"", "userAgent":"", "api":"", "httpMethod":"", "httpStatus" :"", "operation" :"", "remoteIP" :""
}
Activity Log Example
The following example is from the
domainmanager-activity.log:
{"username":"[email protected]", "timestamp":"2022-01-19T16:59:01.9192 ", "client IP":"10.0.0.253", "userAgent":"Mozilla/5.0 (Windows NT 6.3; Win 64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36", "api":"/domainmanager/vl/vra/domains","httpMethod":"GET", "httpStatus":200, "operation":"Gets vRealize Automation integration status for workload domains","remote IP":"127.0.0.1"}
- username: The username of the system from which the API request is triggered. For example: "[email protected]".
- timestamp: Date and time of the operation performed in the UTC format "YYYY-MM-DD'T'HH:MM:SS.SSSXXX". For example: "2022-01-19T16:59:01.9192".
- client IP: The IP address of the user’s system. For example: "10.0.0.253".
- userAgent: The user’s system information such as the web browser name, web browser version, operating system name, and operating system architecture type. For example: "Mozilla/5.0 (Windows NT 6.3; Win 64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36".
- api: The API invoked to perform the opeartion. For example: "/domainmanager/vl/vra/domains".
- httpMethod: HTTP method of the REST API. For example: "GET".
- httpStatus: The response code received after invoking the API. For example: 200.
- operation: The operation or activity that was performed. For example: "Gets vRealize Automation integration status for workload domains".
- remoteIP: remoteIP of the request initiator. For example: "127.0.0.1"
Activity Logs Retention Policy
Log files are rolled over daily to a file using the following naming format: <service-name>.<YYYY>-<MM>-<DD>.0.log.gz. For example: domainmanager.2022-01-22.0.log.gz.
The log history is stored for 30 days. The maximum file size of the log retention file is set to 100 MB.
Log Analysis
You can perform log aggregation and analysis by integrating vRealize Log Insight with VMware Cloud Foundation. For more information, see Implementation of Intelligent Logging and Analytics for VMware Cloud Foundation.
